The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses the subprocess module to orchestrate its pipeline and call external tools like LaTeX, BibTeX, and Pandoc.
Evidence: Found in scripts/pipeline_runner.py, scripts/compile_latex_with_bibtex.py, and scripts/convert_latex_to_word.py.
Mitigation: The skill employs shlex.quote for shell argument escaping and performs regex-based sanitization on user-provided topic names and file stems to prevent injection attacks.
[EXTERNAL_DOWNLOADS]: The skill fetches bibliographic metadata and paper abstracts from well-known academic services.
Sources: Interaction with the official APIs of Crossref (api.crossref.org), OpenAlex (api.openalex.org), and Semantic Scholar (api.semanticscholar.org) was detected.
Risk Assessment: These are trusted academic repositories, and the data retrieved is used exclusively for content generation and citation management.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests large amounts of untrusted text (research abstracts) from the web.
Attack Surface: Maliciously crafted abstracts could attempt to influence the AI's summarizing or scoring behavior.
Mitigation: The risk is mitigated by a strong security architecture that isolates the AI's execution environment to a specific workspace and escapes ingested text before including it in LaTeX source files.
[SAFE]: The skill includes a dedicated security module, scripts/path_scope.py, which enforces workspace isolation.
Implementation: It uses the SYSTEMATIC_LITERATURE_REVIEW_SCOPE_ROOT environment variable to ensure that all file read/write operations are confined to the designated task directory, effectively preventing directory traversal and cross-run data contamination.

research-literature-review